CVE-2025-11707
IP Block Bypass in WordPress Login Lockdown Plugin
Publication date: 2025-12-13
Last updated on: 2025-12-13
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | login_lockdown_and_protection | 2.14 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-330 | The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Login Lockdown & Protection plugin for WordPress (up to version 2.14) where the $unblock_key is not random enough. This allows unauthenticated users who know an administrative user's email to generate valid unblock keys for their own IP address, enabling them to bypass IP blocks that are meant to prevent invalid login attempts.
How can this vulnerability impact me? :
An attacker can bypass IP blocks designed to prevent repeated invalid login attempts, potentially allowing them to continue attempting unauthorized access without being blocked. This could lead to increased risk of brute force attacks or unauthorized access attempts.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring failed login attempts and checking if IP addresses are being locked down and then bypassed unexpectedly. Since the vulnerability involves generating unblock keys to bypass IP blocks, you can look for unusual unblock key generation or unblock requests. Specifically, you can check the WordPress plugin's logs or database entries related to failed login attempts and lockdown records. Commands to detect suspicious activity might include querying the WordPress database for lockdown records and unblock key usage, for example using SQL queries to inspect the lockdown table for frequent unblock requests or unexpected unblock key generations. Additionally, monitoring HTTP requests to the unblock URL with valid unblock keys from unauthorized IPs could indicate exploitation attempts. However, no specific commands are provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Login Lockdown & Protection WordPress plugin to version 2.15 or later, where the vulnerability is fixed by improving the randomness of the unblock key generation. This update replaces the insecure method of generating unblock keys with a cryptographically secure method using `md5(wp_generate_password(24))`. Applying this update will prevent unauthenticated users from generating valid unblock keys and bypassing IP blocks. Additionally, reviewing and tightening access to administrative user emails and monitoring unblock requests can help mitigate exploitation. [1]